CVE-2023-42780

MEDIUM6.5EPSS 0.13%

Apache Airflow: Improper access control vulnerability in the "List dag warnings" feature

發布日:2023/10/14修改日:2025/5/20

也稱為:GHSA-cgx2-rrmr-jx43BIT-airflow-2023-42780PYSEC-2023-202

描述

Apache Airflow, versions prior to 2.7.2, contains a security vulnerability that allows authenticated users of Airflow to list warnings for all DAGs, even if the user had no permission to see those DAGs. It would reveal the dag_ids and the stack-traces of import errors for those DAGs with import errors. Users of Apache Airflow are advised to upgrade to version 2.7.2 or newer to mitigate the risk associated with this vulnerability.

受影響套件(3)

Bitnami/airflowfrom 0, < 2.7.2
PyPI/apache-airflowfrom 0, < 2.7.2
PyPI/apache-airflowfrom 0, < 2.7.2

CVSS 分數

來源	版本	嚴重程度	向量
osv	CVSS 3.1	MEDIUM6.5	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

參考連結(6)

ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2023-42780
PATCHhttps://github.com/apache/airflow
WEBhttps://github.com/apache/airflow/commit/cf4eb3fb9b5cf4a8369b890e39523d4c05eed161
WEBhttps://github.com/apache/airflow/pull/34355
WEBhttps://github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2023-202.yaml
WEBhttps://lists.apache.org/thread/h5tvsvov8j55wojt5sojdprs05oby34d